Critical NGINX Vulnerability Lets Hackers Launch Remote Code Execution Attacks

A newly disclosed unauthenticated heap-buffer-overflow in NGINX (CVE-2026-42945) is being actively exploited: specially crafted HTTP requests can crash worker processes and, in some configurations (specific rewrite rules and ASLR disabled), enable remote code execution. VulnCheck observed exploitation attempts days after disclosure and Censys data indicates roughly 5.7 million internet-facing NGINX servers run potentially affected versions, so immediate patching, configuration audits, and monitoring are recommended.